Race Condition in account survey

Disclosed: 2017-11-12 11:25:59 By cablej To slack
Unknown
Vulnerability Details
There exists a race condition in the beginning survey, allowing a user to get $100 in credit multiple times. In my example, I made 2 asynchronous requests, and was credited with $200. POC: 1. Create a new slack team. 2. Set your password, and find the account creation survey. 3. Complete the survey, and intercept the request using a proxy such as BurpSuite. 4. Repeat the request asynchronously, such as in the command line by executing `(command) & (command)`. 5. The survey will be credited to your account multiple times. See the attached screenshot. Please let me know if you need any more information.
Actions
View on HackerOne
Report Stats
  • Report ID: 165570
  • State: Closed
  • Substate: resolved
  • Upvotes: 22
Share this report